The Underworld of Malicious Paid Online Trolls

In the industrial chain of cyber paid trolls, the upstream side is dominated by funders who issue orders, the midstream includes PR agencies or MCN (Multi-Channel Network) institutions that break down and distribute tasks, as well as group control system providers, account dealers, cloud device service providers and other players that provide supporting infrastructure, while the downstream is made up of a large number of part-time workers who receive orders and post content. The false information, inflated traffic and manipulated reviews produced in batches through this chain sway public opinion trends, leaving countless enterprises mired in this quagmire.

A snack store brand with outlets often located at crossroads across the country, whose cartoon avatar on the store sign has rotating eyes, was once falsely described as a hidden surveillance camera...

In April this year, this absurd rumor spawned thousands of related pieces of content on Douyin within a single day, with a single video gaining more than 50,000 likes at most, and even lured unsuspecting consumers to gather at the stores to take photos, exclaiming that "it is extremely terrifying when you think deeply about it". Later, the enterprise submitted evidence, the platform released a rumor-refuting notice, included relevant entries in the rumor database, removed more than 1,500 pieces of rumor-related content, and cleaned up 88,000 violating comments.

A large number of posts and comments fermented and spread across multiple platforms in a short period of time, and the involved enterprise suspected that it had been attacked by cyber paid trolls. This type of online paid trolls organizes the release of negative false information and malicious review manipulation, so as to earn illegal traffic share or strike competitors.

The people who post the content most likely do not really understand the content they are posting, nor do they realize that the act of smearing an enterprise or a product is suspected of being illegal, and they are only responsible for copying, pasting and clicking to post.

In June, a marketing staff of an imaging company received a report from a user, who said that he originally only wanted to make some extra money with a few taps, but was gradually pulled into 4 WeChat groups: the first group was for registration and task sign-up, and the client would review the homepage of each account; after passing the review, he was pulled into the second group, where everyone grabbed tasks to publish pre-packaged copy on the designated platforms, including content criticizing the products of this imaging company; the third group was used for checking and accepting the posted links; after going through this strict process, the poster finally received payment in the fourth group — a WeChat red envelope of 6 yuan.

On this cyber paid troll industrial chain, the upstream side is dominated by funders who issue orders, the midstream includes PR agencies or MCN (Multi-Channel Network) institutions that break down and distribute tasks, as well as group control system providers, account dealers, cloud device service providers and other players that provide supporting infrastructure, while the downstream is made up of a large number of part-time workers who receive orders and post content. The false information, inflated traffic and manipulated reviews produced in batches through this chain sway public opinion trends, leaving countless enterprises mired in this quagmire.

On August 4th, Toutiao released its platform governance achievements in the first half of the year. In the governance of online paid trolls, it cleaned up more than 16.23 million troll comments, dealt with 3,287 troll accounts, and listed "strictly prohibiting the creation of false public opinion trends by relying on trolls", "governing marketing trolls to create momentum, and strictly investigating template-based batch comments" as key governance priorities.

While platforms are taking actions, regulatory authorities have also continued to strike hard, and China's first special law dedicated to anti-online violence governance is about to be implemented. On July 29th, the Cyberspace Administration of China released the *Anti-Online Violence Law of the People's Republic of China (Draft for Comment)*, launching a combined set of measures targeting platform governance, government governance, co-governance by all sectors of society, and judicial protection. It points out that no organization or individual may carry out marketing hype, unfair competition and other activities through online violence.

How to Identify Cyber Paid Trolls

For enterprises, the identification of cyber paid trolls usually starts from abnormal data dimensions.

The aforementioned marketing staff of the imaging company is responsible for connecting KOLs (Key Opinion Leaders), self-media and MCN companies, and paying attention to user feedback in daily work. In daily monitoring, he found that if the market end densely receives a large number of negative reviews sent by IP addresses from different regions at similar times, and the copy and punctuation marks are exactly the same, it is likely to be the work of trolls. For example, on the release night of an e-ink screen wireless microphone in mid-May, a large number of reviews describing the product as "power-consuming and fragile" emerged on social media. This made the product team very confused: "The e-ink screen hardly consumes power when displaying static content, and only consumes power at the moment of switching the logo. Moreover, this product is more oriented to creators rather than mass consumers. The emergence of a large number of reviews saying the product is fragile on the very night of release is beyond our expectation." said the marketing staff of the imaging company.

A leading internet company also often suffers from similar situations. According to the summary of relevant personnel of this enterprise, trolls can be divided into different levels based on their concealment and lethality:

Ordinary trolls post little content, have few followers, and their IP addresses are mostly concentrated in large populous provinces or fourth- and fifth-tier cities; their posts carry unified topics and have similar copy structures, generally in the pattern of "praising A first, then criticizing B". The copy of mid-level trolls is professionally polished, logically self-consistent, and can make their criticism convincing. The industry has even evolved high-level trolls, such as "pretending-to-be fans of the targeted brand to smear it", who disguise themselves as senior users or fans of competing products, provoke disputes, and smear a certain enterprise in a reverse way.

The staff of this leading internet company said that most enterprises still use cheap low-level trolls. On the one hand, "pretending-to-be fans of the targeted brand to smear it" requires raising accounts in advance to gain trust and publish relevant content, which costs too much; on the other hand, there is a risk that the disguise of such trolls will fail, and most internet users will not pay attention to the source of the account. Using ordinary trolls to boost volume first has a higher cost performance.

There is also a type of high-level trolls that test planning capabilities, and are good at combining the negative information of enterprises with sensitive issues.

A fast-moving consumer snack brand was recently involved in a public opinion incident claiming that "people lost all their investment after paying hundreds of thousands of yuan to join the brand". According to the observation of the public opinion monitoring personnel of this enterprise, hundreds of similar posts appeared within one day, published by different accounts with only slight modifications to the content, for example, changing 300,000 yuan to 500,000 yuan, and changing the person involved to cousin, cousin or colleague. After a batch of posts were published, a small number of links received high attention, and the comment section became the main battlefield, where comments accusing the enterprise of "cutting leeks from franchisees" and "carrying out capital operations for listing" were liked to the top positions. Later, the main text of the posts and comments were screenshot, and then spread to Toutiao, Baidu Baijiahao, Haokan Video and WeChat ecosystem.

Operate Efficiently, Act on Orders

A person from a leading new energy vehicle enterprise revealed that some companies will build troll channels by investing in or hiring external PR companies, and carry out multi-layer subcontracting to isolate risks. Such services are usually packaged as "reputation maintenance" or "brand image maintenance".

The person from this leading new energy vehicle enterprise believes that as the client, enterprises do not have the possibility to raise a group of trolls to guide the rhythm of public opinion. First, their freedom is limited. For example, it is absolutely not allowed inside an enterprise to create spoof topics and funny parody videos targeting the boss or executives. Second, they lack the ability of instant communication. Third-party PR companies have a large number of account matrices, which can generate links within three minutes and publish them concentratedly on the internet.

The comment section is one of the main battlefields for trolls, and its credibility is sometimes higher than that of the main post. The person from this leading new energy vehicle enterprise introduced: On platforms such as Weibo, Xiaohongshu, Douyin and Toutiao, enterprises often need to monitor the comment sections, pay ordinary users to publish pre-prepared content in the comment sections, and brush likes for high-quality comments.

As the risk of posting negative posts gets higher and higher, commercial warfare has become more concealed. Some organizers of "cyber paid trolls" will recruit ordinary users, and put paid traffic on ordinary posts where real users complain about the problems of competitors' products to amplify the influence. The whole process is legal and compliant, and the only abnormality is: ordinary users who just hate a product generally will not spend hundreds or thousands of yuan on paid traffic for a stranger's post.

In the bottom recruitment and task distribution link, the organizers will avoid mentioning sensitive words such as "make money by posting", and package the work as completing tasks and earning points. A paid post recruitment notice obtained by *The Economic Observer* states that each account can only participate once in a single task, and the account must be switched for multiple participations; after completing the task, it must be registered in the form, and each task is rewarded with points equivalent to 5 yuan; points are settled every half a month.

Some MCN institutions will require troll accounts to modify their IP addresses. The aforementioned marketing staff of the imaging company revealed that first-tier cities are the main market for consumer electronics enterprises. If the IP addresses of negative posts are concentrated in low-tier cities, the credibility of the remarks will be greatly reduced.

According to the understanding of the person in charge of a media company headquartered in Guangzhou, "group control" is a relatively downstream part of the industrial chain, which provides services such as organizing cyber paid trolls to like, comment and repost in batches, that is, using one computer or server to control dozens to tens of thousands of mobile devices at the same time, to complete batch registration, login, liking, commenting, reposting and other operations, simulating the behavior of real users to avoid platform supervision.

The most basic application scenario of the "group control" business is to brush positive or negative reviews on platforms such as Dianping, Xiaohongshu and Douyin Group Buying, with orders from catering and e-commerce enterprises taking the largest share; the second is to provide customized services for a small number of enterprise clients to post negative posts and guide public opinion.

The person in charge of this media company revealed that publishing posts in batches from the same IP address will easily trigger the platform's risk control review. The industry generally uses equipment such as "cloud devices" to modify the IP addresses of accounts in batches, which is low in operation difficulty. Cloud devices can be used to raise accounts and post content in batches. On social media, cloud device equipment and service providers look for new customers under posts related to cross-border e-commerce, and introduce the "benefits" of cloud devices: a cloud device can solve many problems, the equipment cost is reduced, and one cloud device is equivalent to 150 mobile phones; it can be built-in with a soft router, so that the IP of each device is completely isolated; the problem of accounts is solved, each account only costs a few cents, and can be discarded once it is invalid.

Real User's Likes, Comments and Reposts Cost More

A quotation list for data operation and maintenance on mainstream social media since May this year obtained by *The Economic Observer* shows that the operation and maintenance prices of different platforms vary greatly, which is mainly affected by three factors: the strictness of the platform's risk control, the operation mode (machine-operated vs. pure manual) and service commitments (whether the content will be included/displayed). This list also reminds that due to risk control reasons, the data operation and maintenance prices of various platforms will fluctuate.

Among them, for the like service, the price is 2.5 yuan per like on Xiaohongshu, 0.4 yuan per like on Toutiao, and about 0.1-0.3 yuan per like on Douyin, WeChat Channels/Public Accounts and Weibo. Liking a comment generally costs 1 yuan per like.

Commenting costs more than liking. Publishing a comment directly under WeChat Channels content costs 1.5 yuan per comment, while a reply to a comment in the comment section costs 5 yuan per comment, and publishing a comment directly with a designated regional IP on WeChat Public Accounts costs 4 yuan per comment. A single comment on Douyin and Xiaohongshu costs about 5 yuan, and the price of replying to a comment in the comment section on Douyin is the highest, about 8 yuan per comment. Machine-operated comments on Weibo only cost 0.15 yuan per comment.

If the client needs targeted comments, such as replying to comments in the comment section, and high-quality pure manual review manipulation, the service form will shift from wholesale to expensive pure manual customization. The operation by real people is several times more expensive than machine operation. Taking Weibo as an example, machine-operated comments only cost 0.15 yuan per comment, while real user comments cost 5 yuan per comment.

Manual review manipulation is generally divided into "guaranteed display" or "guaranteed screenshot but no display guarantee". The former promises to reach users, while the latter only provides screenshots after the execution is completed. The starting price for ordinary user accounts to publish content from different IPs across the country is 80 yuan per post, and the starting price for KOC (Key Opinion Consumer) to publish content is 200 yuan per post.

Many enterprise personnel who have purchased "troll services" mentioned that the quotations of different suppliers vary greatly, and the price difference between direct purchase and purchasing from sub-contracted second, third, fourth parties can reach several times.

The aforementioned person from the media company explained that platforms have review links, and posts sent by inactive dead accounts, zombie accounts or accounts with inconsistent tags have a very low probability of being successfully displayed. "The industry's conventional settlement standard only depends on the exposure rate, and only posts that are successfully published and can be searched are counted as one valid output."

For the same service content, the price is directly related to the minimum order quantity and whether the order is placed directly with the data operation and maintenance institution. A person from the marketing department of a mobile phone manufacturer revealed that skipping PR companies and MCN institutions, direct purchase and long-term cooperation are more cost-effective. Except for platforms with high risk control levels, machine-operated comments on mainstream platforms cost about 0.3 yuan per comment, and manual comments cost about 1.2 yuan per comment.

The person from this media company revealed that before social media fully implemented real-name system and strengthened risk control, players in the industry could raise accounts in batches. Second-hand mobile phones cost about 800 yuan per unit, high-quality ordinary user accounts cost hundreds of yuan per unit, and you can start the business after purchasing a batch. "All merchants, brands and internet celebrities who need promotion have such demands. Operators only need to prepare hundreds of mobile phones, charge agency operation fees based on the exposure, and one account can be used unlimited times." He revealed that college students, secondary vocational school students, and stay-at-home moms and other external ordinary users are the main force of posting. Organizers distribute demands through WeChat groups and QQ groups, and personnel can join and quit quickly.

There is also a traffic fee in the account raising cost. "If you use real mobile phones to raise accounts, one mobile phone is bound to one account, cannot connect to public WiFi, and must use mobile data separately, because batch operations under the same gateway IP address will easily lead to direct account bans. The monthly fee for each mobile phone SIM card is about tens of yuan." The person from this media company revealed that the platform's intensified risk control has greatly increased the operating cost of the troll industry. For example, once the system identifies an abnormality, it will trigger risk control and require face verification, otherwise the accounts may be banned in batches. The rising account ban rate leads to an increase in account cost. As it is difficult to find enough "real people" to complete real-name authentication, the service fees for planting reviews, brushing comments and customizing "negative posts" are getting higher and higher.

Some institutions can be equipped with AI troll matrices exclusive to clients. For example, organizing 100 troll accounts can be divided into different identities such as 30 former employees of the company, 30 members of the public, and 20 industry experts to post content. The client only needs to provide keywords, the posting content is generated by AI, and only a small team is needed for operation.

Governance Challenges

The data of posts, comments, likes and reposts by robots is average, but it is possible to influence the algorithm with absolute quantity in a short time. The aforementioned person from the leading internet company found that once the algorithm is deceived, and the attention of real internet users is ignited and takes over the discussion, these robot accounts will quickly delete their posting records. Such cyber paid trolls only want to affect the recommendation stream, and their content disappears immediately after being read, making it difficult for competitors and regulatory authorities to trace the source.

When a cross-border e-commerce enterprise encounters concentrated cyber paid troll attacks, it will collect evidence and feedback to the local regulatory department of the platform, and apply for batch processing.

The relevant business personnel of the aforementioned fast-moving consumer snack enterprise evaluated that some negative posts may affect the mindset of customer groups, affecting both investment promotion and C-end sales.

Judging only from the difficulty of processing, the relevant business personnel of this fast-moving consumer snack enterprise believe that the most difficult platforms to deal with are WeChat Public Accounts and Channels, followed by Xiaohongshu. Enterprises can